POLICY FRAMEWORK AND STANDARDS INFORMATION SHARING BETWEEN GOVERNMENT AGENCIES

Transcription

1 POLICY FRAMEWORK AND STANDARDS INFORMATION SHARING BETWEEN GOVERNMENT AGENCIES January 2003

2 CONTENTS Page 1. POLICY FRAMEWORK 1.1 Introduction Policy Statement Aims of the Policy Principles of information sharing Enablers and Strategies for Implementation Summary 3 2. STANDARDS FOR MANAGING PERSONAL AND IN-CONFIDENCE INFORMATION 2.1 Legal Provisions Apply Purpose Defined Minimum Information Exchanged Equitable and Fair Treatment of Clients Rights and Obligations Observed Shared Information is Secure Issue of Consent Register Kept Conclusion 7 APPENDIX Appendix 1: Outline Memorandum of Understanding 8

3 POLICY FRAMEWORK AND STANDARDS INFORMATION SHARING BETWEEN GOVERNMENT AGENCIES PART 1 POLICY FRAMEWORK 1.1 Introduction A Senior Officers Group has developed a framework for information sharing between agencies. Appropriate information sharing will improve outcomes for clients and the community through more coordinated services and increased operational efficiency. The Government of Western Australia is committed to improving community and client outcomes, and achieving more coordinated services through interagency collaboration involving information sharing. Implementing this commitment requires Government agencies to have a common or shared understanding of processes relating to information sharing. Importantly, in the interests of accountability, information sharing needs to be supported by processes and applications that provide for the secure storage and transfer of information. 1.2 Policy Statement The policy framework is to facilitate information sharing on a structured basis. It is an interim document which will later need to be modified in the event that privacy legislation is developed by the State Government. While it is designed to continue and enhance the flow of information within existing legislative and other parameters, it is not intended or considered necessary to formally structure all information sharing arrangements by agencies at this time. Consistent with the Government's commitment to improved community and client outcomes, Government agencies are encouraged to share information on a structured basis. 1.3 Aims of the Policy This policy framework aims to build upon the information sharing that is currently occurring between agencies. It recognises that the community is demanding seamless services from agencies, and expects positive outcomes from government spending. Structured sharing of important, and often sensitive, information is frequently needed to achieve improved community outcomes, benefits to clients, and better coordinated services. As government agencies have a duty of care to all clients, especially children, information held by other agencies can be crucial to safeguarding the welfare and safety of clients. The aims of information sharing between government agencies are therefore to:

4 Information Sharing Between Government Agencies 2 Improve Community Outcomes Many problems experienced by the community do not have a simple or single solution. By working collaboratively to tackle complex issues, agencies can achieve better outcomes for the community. Some examples of issues which require an across government approach include: Prevention and early intervention in crime; Assistance in areas of health or family development; Maximising community safety; Addressing the underlying causes leading to disadvantage experienced by some groups in the community; and Improving educational outcomes for young people. Improve Client Outcomes Many individuals and families experience multifaceted disadvantage. An across-government approach can help agencies provide better services to them and assist the agencies to exercise their duty of care. Some examples include assisting families who may be experiencing multiple problems such as: Housing issues; Children who are not coping at school; and Adolescent/parent conflict. Better Coordinate Services Sharing information and coordinated services enable better targeting in a concerted and collaborative effort to solve serious and pressing problems. Some examples where collaboration will lead to more coordinated services include: Addressing significant issues such as reducing Aboriginal over-representation in the justice system (eg Aboriginal Cyclic Offending Program); and Management of casework where families have multiple issues such as truancy, parentadolescent conflict, housing concerns, etc. (Strong Families Collaborative Case Management Pilot). 1.4 Principles of information sharing Where information sharing occurs, it is to be undertaken on a basis which achieves an appropriate balance between competing interests of the community, agencies and individual clients. On that basis, the following high level principles drive this Policy Framework and Standards. Agencies must act within the limits of relevant legislation. Open and accountable processes and procedures are required for information sharing. Information sharing should be consistent with appropriate minimum privacy standards such as the National Privacy Principles. Procedures need provide for the security of confidential information. Agencies sharing information do so within the context of information policies, procedures and practices, relevant legislation and privacy principles. 1.5 Enablers and Strategies for Implementation Information sharing is enabled by: (1) Implementing a Policy Framework and Standards When applied by agencies this policy: Promotes information sharing to achieve better outcomes for clients; Suggests processes for overcoming barriers to sharing information; and Provides information handling standards to safeguard clients and officers. (2) Memorandum of Understanding (see Appendix 1 for draft outline MOU) A Memorandum of Understanding (MOU) is an agreement which sets out a structured process for information sharing, enabling officers to exchange defined information to the full extent permitted by current legislation. MOUs provide a structure for sharing information to provide

5 Information Sharing Between Government Agencies 3 improved services while protecting the rights of clients and government officers. It is proposed that MOUs be signed-off by the Chief Executive Officers of participating agencies. Both in relation to current and proposed information sharing arrangements, it is essential that agencies check that their arrangements are consistent with existing legislative provisions. Parties to an MOU should: Identify the circumstances when information sharing should occur based on an analysis of the need for the information sharing, and its benefits and costs; Establish agreed ground rules for information sharing to ensure that it is within legal parameters; Achieve agreed sign-off by agencies (CEOs); Review arrangements as necessary; and Legislate as necessary. A formal MOU process will: Help clarify legal obligations, rights and responsibilities thereby facilitating information sharing; and Enable more effective collaboration. A structured MOU may have application in a wide variety of circumstances, but does not preclude appropriate informal information sharing arrangements. However, where possible, agencies should work towards formalising any unstructured arrangements. (3) Targeted legislation to support specific MOUs Current provisions relating to information exchange across Government are addressed in a number of Acts, subsidiary legislation and policy documents which regulate and control the sharing of information when that information has been obtained in the course of officers duties or agency functions. Legislative amendments may be needed to address specific impediments to information sharing. (4) CEO Endorsement of MOUs, and related Actions CEOs are committed to achieving an environment more conducive to interagency information sharing with their endorsement of structured information sharing arrangements, and demonstrated support of officers involved in approved information sharing arrangements. More specifically, CEOs are committed to encouraging senior officers to: Actively seek and act upon opportunities to share information where it will lead to improved services; Identify and clarify provisions within their legislation which enable information sharing; Identify where legislative amendments are warranted to address specific impediments to appropriate information sharing (legal advice may be sought where necessary for particular cases); Implement this Policy Framework and Standards; Audit existing and proposed memoranda of understanding and agency guidelines to ensure they reflect this policy; Ensure a register of information sharing arrangements is maintained; and Continue to review MOUs for relevance. 1.6 Summary Information sharing has the support of Government and CEOs. It requires a top down approach, with CEOs being accountable for the process and outcomes. Senior managers need to be encouraged to seek opportunities to improve agency performance through shared information. They also need to monitor the information sharing process. Officers need to know that they will be supported in sharing information when properly undertaken. Part 2 of this Policy Framework and Standards deals specifically with Standards expected by Government of its agencies and officers in managing personal and in-confidence information.

6 Information Sharing Between Government Agencies 4 PART 2 STANDARDS FOR MANAGING PERSONAL AND IN-CONFIDENCE INFORMATION Government officers frequently have access to personal and in-confidence information. Through information sharing, officers will in future have access to a wider range of personal and in-confidence information. In all cases, government agencies have a duty of care in managing that information regardless of which agency generated the information in the first instance. These minimum Standards provide principles and guidelines that should be adopted in information sharing and handling, whether the source information is generated internally or acquired from other agencies. These Standards may be expanded or modified, depending on the circumstances, by agencies/parties to an information sharing arrangement. The Standards should be defined and agreed to by the agencies involved, as part of the Memorandum of Understanding. As a broad overview for collecting and sharing information, the following issues need to be considered. 2.1 Legal Provisions Apply Agencies are required to adhere to statutory provisions and common law, and should clarify and articulate powers enabling information sharing or indeed acting to prevent it. Agencies should examine their own legislation to see if it restricts the exchange of information. There is also overarching legislation which contains secrecy or confidentiality provisions such as the Public Sector Management Act 1994 and the Criminal Code (section 81 creates an offence of disclosing official secrets with a penalty of two years imprisonment). Further, there are common law obligations which may be relevant (e.g. a legal or equitable obligation of confidence), and create a duty not to disclose information received in such circumstances. In summary, agencies should ensure that any information sharing agreement does not breach any law to which they are subject. Agencies should also be aware that the Freedom of Information Act 1992 gives individuals the right to access information regarding themselves. Privacy principles also provide persons with a right to access information regarding themselves. It is therefore prudent for agencies in collecting and sharing to buildin clients rights to access information, and grievance procedures for breaches of privacy arising from information sharing arrangements. At this time, Western Australia does not have privacy legislation. However, Commonwealth agencies are subject to the Federal Privacy Act 1988 which requires them to comply with the Information Privacy Principles. As Western Australia may develop privacy legislation in the near future, it is prudent for government agencies to ensure that their policies and practices are consistent with accepted minimum privacy principles. Government agencies should also be aware that the Commonwealth Privacy Amendment (Private Sector) Act 2000 which came into effect in December 2001, may impact on some private sector organisations with whom Government agencies share information. The private sector organisations which come within the scope of this legislation will be required to abide by the National Privacy Principles. Where Government agencies have contracts or enter into Memoranda of Understanding with private sector organisations which are not bound by the amendment, Government agencies should consider whether they should require the private sector organisations to abide by appropriate privacy principles. If in doubt regarding what legal provisions may be relevant, legal advice should be sought in relation to the particular Memoranda of Understanding. 2.2 Purpose Defined Before entering into any agreement, agencies should undertake an analysis of the need for the information sharing, and its benefits and costs. Information should only be exchanged where there is a

7 Information Sharing Between Government Agencies 5 demonstrated need, and the perceived benefits clearly outweigh any privacy issues. The purposes for collecting, storing and allowing access to information should be clear and specific. The reasons for collecting the information and how the information will be used or shared should be explained to clients at the time of collection. Although they do not directly apply to Western Australian Government agencies, the National Privacy Principles, for example, provide that information should only be used for the primary purpose of collection, and must not (with some exceptions) be used for a secondary purpose (a purpose other than for which it was collected). Where an MOU has been developed, the purpose for sharing the information should be clear and specific. If the information exchange is not for the purpose for which the information was collected, consideration should be given to obtaining the consent of the individual(s) concerned, where possible. Consideration could also be given to obtaining the information directly from the individual. However, it should be noted that privacy legislation typically provides exceptions such as where the health or safety of an individual is at risk or for law enforcement purposes. The circumstances under which information sharing may or may not occur should be defined and agreed to within the Memorandum of Understanding. These documents should be sufficiently explicit to avoid confusion as to whether particular classes of information come within the scope of the document. 2.3 Minimum Information Exchanged The minimum amount of information should be shared to achieve the required results, and agencies should ensure that the information shared is necessary for the primary purpose for which it was collected. 2.4 Equitable and Fair Treatment of Clients Clients should be treated in an equitable and fair manner through consistent criteria being applied to determine whether and what information is to be shared. 2.5 Rights and Obligations Observed Mutual rights and obligations apply to the sharing of information. Clients generally have rights in regard to information held about themselves, and in many cases access to such information can be routinely obtained on request. Memoranda of Understanding should make reference to clients being advised of their rights under the FOI Act or in respect of any breach of privacy. Consideration should be given to the need for a client advocate. Government officers have the right to CEO support in their formal information sharing arrangements, whilst also having obligations to maintain appropriate confidentialities, and adhere to relevant policies and procedures. Under FOI legislation and generally accepted privacy principles, agencies may limit access to personal information where such access would pose a serious threat to the life or health of any individual, or would have an unreasonable impact upon the other individuals or for public policy reasons. In these circumstances, legal advice should be sought on a case by case basis. With some exceptions, agencies should not pass on information they have received through an information sharing agreement to third or other parties, without the consent of the individual concerned and/or the agency which initially gathered the information. These exceptions involve such circumstances as where the health or safety of an individual is at risk or for law enforcement purposes, or where the individual would normally expect the information to be passed on to another agency. If a party to the information sharing wishes to share information with third or other parties for further collaborative case management, the consent of the individual or the first agency should be sought, unless otherwise agreed. Where possible, information should be obtained directly from the client.

8 Information Sharing Between Government Agencies 6 Agencies may specifically wish to address in Memoranda of Understanding issues relating to information subpoenaed or otherwise required to be disclosed pursuant to a court process. Accuracy of Information: Agencies should take all reasonable steps to ensure that information collected and shared about clients is accurate, complete, and up to date. Agencies should take action to correct information if it is found to be inaccurate, and should take reasonable steps to notify agencies which have received the information from the disclosing agency, that the correction is necessary. In some circumstances, particularly in areas such as child protection, it is necessary for agencies to record information, take actions and exchange information based on allegations rather than a higher standard of proof. These decisions will be based on a risk assessment. The rights of the person who is the subject of an unproven allegation must also be taken into account. Memoranda of Understanding should address the issue of recording and sharing, both factual information and allegations. 2.6 Shared Information is Secure Agencies should keep information about clients secure. Examples may include: Enabling file access to only those officers directly involved in the case management of clients, and to those with a statutory right to access that information; Storing shared case management files, as with other confidential and classified records, separate from other agency files; and Ensuring that for any research, reporting, or other related purposes involving external parties (eg universities), anonymous or aggregate information is used. Any research should be approved by institutional and agency Ethics Committees. The consent of the clients would generally be required to use non-aggregated data. Where information is shared, procedures should ensure appropriate protection of government officers, clients and community in this regard. This is facilitated by the maintenance of good records which include, where appropriate, client consent and participation, goals and benefits of information sharing, etc. MOUs or other information sharing agreements are to show security processes agreed to by sharing parties. 2.7 Issue of Consent When developing or negotiating MOUs or protocols for particular collaboration projects, particular consideration is to be given to the issue of consent. The issue of consent is particularly important when dealing with personal information. Under privacy principles, personal information is subject to stricter guidelines for collection, use and disclosure. Before passing on information, agencies should consider whether it is practical to obtain the consent of the client or whether there are less intrusive strategies to achieve the objective. If it is appropriate, reasonable and practical to do so, an organisation should collect personal information about an individual from that individual. Where personal information is shared, the individual should, unless there are good reasons for not doing so, be made aware of the situation, their rights to access the information, the purpose for which the information has been shared, etc. Some issues relating to consent that need to be considered, or on which legal advice should be taken include: Having regard to 2.1, whether consent is appropriate or necessary in the circumstances; Even where consent is obtained, whether there are any legislative, common law or other barriers to information sharing; Where consent is considered to be appropriate or necessary: Whether the consent of all parties is necessary; How consent applies, if at all, to aggregate (summarised de-identified) data; How informed consent in respect to minors, persons with decision-making disabilities or persons with specific communication requirements can be addressed; Duration of consent;

9 Information Sharing Between Government Agencies 7 How the issue of withdrawal of consent or correction of information may impact on the use of information already generated and/or shared; and Whether obtaining consent could impact on a client s physical safety or psychological well-being. The Memoranda of Understanding, or protocols for particular collaboration projects, should address these and other issues relating to consent, and will usually entail legal advice being sought. 2.8 Register Kept A Register of MOUs should be kept by agencies, and is to include: The title for the case/situation; Parties to the sharing of information; Summary information on the consent and participation of individuals concerned. Summary purpose of sharing information; and Date and duration of the MOU. This register should be kept strictly secure. 2.9 Conclusion This provides a minimum overview of standards to be applied in the management of personal and inconfidence information. In that regard, it is merely indicative of the inquiries and efforts that should be made in deciding how such information is properly managed. In this regard, agencies and individual officers should also be cognisant of, among other things: Their agency s legislation; Relevant provisions of the Public Sector Management Act and other whole of Government legislation; Common law in the area of confidentiality; Government and agency policies on information sharing and management; National Privacy Principles which provide a suggested comprehensive approach to issues relating to the management of information; and The possible application of the Commonwealth Privacy Amendment (Private Sector) Act 2000 to organisations which Government agencies deal with.

10 Information Sharing Between Government Agencies 8 APPENDIX 1: OUTLINE MEMORANDUM OF UNDERSTANDING MEMORANDUM OF UNDERSTANDING (NAME OF INITIATIVE) BETWEEN Agency 1.. Agency 2.. Agency 3.. Agency 4.. (Purpose for sharing information)

11 Information Sharing Between Government Agencies 9 LIST OF CONTENTS 1. Project (name) 2. Objectives of the MOU 3. Project/information sharing initiative details 3.1 Shared Principles 3.2 Definitions (agreed definitions and exceptions) 3.3 Drivers 3.4 Target Group 4. Case management 4.1 Client Consent and Participation 4.2 Case Management Team detailed 4.2. Roles and Responsibilities of Team Members 4.3. Roles and Responsibilities of Agencies 4.4 Priorities of Case Management (or collaborative initiative) 4.5 Principles of Case Management or other specific initiative 4.6 Client Access to Records and Grievance Procedures 5. Information to be shared 6. General provisions 6.1 Authority to Enter into an Agreement 6.2 Honour Clause 6.3 Privacy 6.4 MOU Review 6.5 Costs 6.6 Conflict of Interest 7. Endorsement by agencies

12 Information Sharing Between Government Agencies Project (name) Provide an introduction and background information on the project. This may include: The problem; Background to the project/initiative; When the project was established; The aims, objectives and target group of the project; Agencies involved; and Anticipated timeframes for achievement of outcomes. 2. Objectives of the MOU Summarise the objectives of the MOU and the project. Objectives may include: Establishing a cooperative working relationship between the parties in order to facilitate collaboration; Facilitating the sharing of information between the parties to enable the effective case management of key customers; and Defining respective roles and responsibilities of the participating agencies, and collaborating organisations. 3. Project/information sharing initiative details This section may include information on: 3.1 Shared Principles maintaining a cooperative partnership; (i) avoiding conflict and impediments to the delivery of the information provision; (ii) taking reasonable steps to assist one another to achieve the objectives of this MOU; and (iii) not knowingly acting in any way to the detriment of other participating agencies or their clients. 3.2 Definitions (agreed definitions and exceptions) 3.3 Drivers (i) (ii) (iii) (iv) (v) (vi) Links to Government Outcomes; Research & statistics; Success or not of existing initiatives, and success of related initiatives elsewhere; Acknowledgement of agencies existing strategies which enhance the initiative; Costs of not undertaking initiative; and Agency key customer groups and programs the initiative will assist. 3.4 Target Group (i) (ii) (iii) Primary customers or customer groups of the initiative; Other customers or customer groups; and Criteria for inclusion as a primary customer eg relationship with range of agencies rather than the issue.

13 Information Sharing Between Government Agencies Case management (where relevant) This section may include information on: 4.1 Client Consent and Participation (i) (ii) (iii) (iv) Detail client consent; Which agency will be keeping the files; How and when clients will be informed of access rights and grievance procedure; Duration of consent. 4.2 Case Management Team detailed (i) (ii) (iii) Purpose of the case management team; The composition of the team (positions, titles, etc); and Meeting details such as frequency, location, approach, facilitator and records management Roles and Responsibilities of Team Members (i) (ii) (iii) (iv) Adhering to agreed policy, principles and procedures; Adhering to agreed information sharing and management principles; Tasks of the team; and Monitoring, reporting and evaluation Roles and Responsibilities of Agencies Include a statement to the affect that agencies agree to share and exchange information detailed in the MOU according to the Government s Policy Framework and Standards, additional principles and procedures specified in this MOU, and applicable laws. 4.5 Priorities of Case Management (or collaborative initiative) List priorities 4.6 Principles of Case Management or other specific initiative These are to be set out in full, drawing on relevant protocols. For example, providing ongoing support and monitoring (as opposed to brief intervention) and undertake a holistic approach to case management (as opposed to addressing the issues of family health/safety/justice/welfare etc in isolation) 4.7 Client Access to Records and Grievance Procedures The MOU should set out clients rights regarding access information pertaining to themselves, and grievance procedures. 5. Information to be shared 5.1 The actual information to be shared (should be specific as is possible); 5.2 The issue of consent; 5.3 What the receiving agency is allowed to do with the information under the MOU; 5.4 What the receiving agency must do if it wishes to use the information for purposes other than agreed in 5.3; 5.5 Any requirements regarding how the information must be stored, and who can access the information, etc; and

14 Information Sharing Between Government Agencies Any requirements sought to be placed on the receiving agency if the information is subpoenaed. 6. General provisions 6.1 Authority to Enter into an Agreement List relevant legislation for each agency (eg Public Sector Management Act 1994, Police Act 1892). 6.2 Honour Clause 6.3 Privacy May include a statement to the effect The MOU is an expression of the purpose and intention of the parties, which is binding in honour only. This MOU is not to give effect to any legal relationship or obligations other than those already in existence under any written law. It is not intended to give rise to any consequences or be the subject of litigation, nor is it intended to subjugate the rights, duties or responsibilities of the parties arising from the provision of information about their customers/clients. A commitment by each party that it acknowledges and undertakes to protect the confidentiality and integrity of the information obtained in the provision of their respective services. This may include: (i) an acknowledgement that the National Privacy Principles reflect baseline standards in the area; and (ii) a reference to the Policy Framework and Standards document. 6.4 MOU Review 6.5 Costs This may include a statement to the effect that: (i) the MOU comprises of this document and any other document specifically referred to only; (ii) the MOU may be amended at any time with the agreement of all parties; and (iii) the MOU will be included on a register of MOUs to be kept by each of the participating agencies. This section should detail the commitments by relevant agencies to provide all necessary materials, equipment and staff in supporting this MOU and in the provision of the services. 6.6 Conflict of Interest MOU should provide a process for dealing with situations involving a conflict of interest. 7. Endorsement by agencies The agencies, through their CEOs, involved sign off to the Memorandum of Understanding.